Octagon A New Android Bot Targeting Crypto Wallets and Banki...

src/mobile-pentesting/android-app-pentesting/accessibility-services-abuse.md

@@ -136,6 +136,21 @@ ClayRat exposes this capability with the `show_block_screen` / `hide_block_scree
 
 Because TYPE_ACCESSIBILITY_OVERLAY windows never raise the `SYSTEM_ALERT_WINDOW` permission prompt, the victim only sees the decoy UI while the RAT keeps interacting with the real apps underneath.
 
+#### Package-keyed HTML gates and JavaScript bridges
+
+A scalable variant keys remotely supplied HTML templates by the foreground package. The accessibility service reads the active package and node tree, selects the matching template, and places an attacker-controlled `WebView` above the real UI. Form values then cross an `addJavascriptInterface` bridge and are serialized as an answer message for C2; the operator can replace the package-to-template map without rebuilding the APK.<sup>[[7]](#references)</sup>
+
+The target map can also contain `com.android.systemui` and OEM keyguard packages. Consequently, the same gate engine used for wallet seed phrases or banking credentials can impersonate the device PIN, password, or pattern screen and capture a device credential that can be replayed against the keyguard before broader on-device fraud.<sup>[[7]](#references)</sup>
+
+When reversing a suspected gate engine, correlate accessibility configuration, active-package checks, HTML assets or `loadData*` calls, bridge registration, and command/message identifiers instead of treating the overlay as an isolated `WebView`.<sup>[[7]](#references)</sup>
+
+```bash
+jadx -d jadx-out sample.apk
+grep -RInE 'getPackageName|getRootInActiveWindow|TYPE_ACCESSIBILITY_OVERLAY' jadx-out
+grep -RInE 'addJavascriptInterface|loadData(WithBaseURL)?|evaluateJavascript' jadx-out
+grep -RInE 'SET_PACKAGE_TEMPLATES|GATE_ANSWER|SystemUI|keyguard' jadx-out
+```
+
 ### 2. On-Device Fraud automation
 Malware families such as **PlayPraetor** maintain a persistent WebSocket channel where the operator can issue high-level commands (`init`, `update`, `alert_arr`, `report_list`, …).  The service translates those commands into the low-level gestures above, achieving real-time unauthorized transactions that easily bypass multi-factor-authentication tied to that very device.<sup>[[3]](#references)</sup>
 
@@ -205,6 +220,31 @@ The **AccessibilityService** is the local engine that turns those cloud commands
 
 ---
 
+## Cover-app initialization, persistence and build correlation
+
+A decoy activity may keep a benign game, launcher, or government page inside an invisible `WebView` while it requests battery/SMS/accessibility access and starts the malicious foreground service. It reveals the cover only after initialization, so analysis must follow lifecycle and visibility changes rather than assuming that the loaded URL represents the APK's purpose.<sup>[[7]](#references)</sup>
+
+Accessibility bots can layer boot receivers, a separate guard process, foreground execution, `AlarmManager` and `WorkManager` watchdogs, network/doze recovery, account synchronization, silent-audio keepalives, battery-optimization exclusion, and OEM autostart settings. Each mechanism should be mapped separately because one component may revive the client after another is stopped.<sup>[[7]](#references)</sup>
+
+Do not trust a packaged protocol version or C2 configuration without tracing the connection path. One observed builder stored protocol version 2 in `config.json` but changed it to version 3 in the foreground service immediately before connecting. Service/bridge names, command identifiers, the final cipher parameters, hard-coded keys, and ports can therefore correlate repackaged builds more reliably than cover pages or destination IPs.<sup>[[7]](#references)</sup>
+
+Useful static and runtime pivots include:<sup>[[7]](#references)</sup>
+
+```bash
+apktool d -f sample.apk -o apktool-out
+jadx -d jadx-out sample.apk
+grep -RInE 'BootReceiver|WorkManager|AlarmManager|addJavascriptInterface|AES/GCM' jadx-out apktool-out
+PACKAGE=com.example.suspect
+adb shell dumpsys package "$PACKAGE"
+adb shell dumpsys jobscheduler | grep -i "$PACKAGE"
+adb shell dumpsys alarm | grep -i "$PACKAGE"
+adb shell ps -A | grep "$PACKAGE"
+```
+
+For example, related Octagon builds reused `com.kisa.octagonpanel`, `WardAccessibilityService`, `WardForegroundService`, `OctagonBridge`, `WARD_GATE_ANSWER`, `GUARDIAN_SET_PACKAGE_TEMPLATES`, TCP port `4444`, and the default passphrase `octagon-default-key-change-me` despite changing their cover content and C2 hosts.<sup>[[7]](#references)</sup>
+
+---
+
 ## Detecting malicious accessibility services
 
 * `adb shell settings get secure enabled_accessibility_services`
@@ -329,5 +369,6 @@ Background and TTPs: https://www.threatfabric.com/blogs/ghost-tap-new-cash-out-t
 - [4] [Android accessibility documentation – Automating UI interaction](https://developer.android.com/guide/topics/ui/accessibility/service)
 - [5] [The Rise of RatOn: From NFC heists to remote control and ATS (ThreatFabric)](https://www.threatfabric.com/blogs/the-rise-of-raton-from-nfc-heists-to-remote-control-and-ats)
 - [6] [GhostTap/NFSkate – NFC relay cash-out tactic (ThreatFabric)](https://www.threatfabric.com/blogs/ghost-tap-new-cash-out-tactic-with-nfc-relay)
+- [7] [Octagon: A New Android Bot Targeting Crypto Wallets and Banking Apps](https://iverify.io/blog/octagon-android-bot-crypto-wallets-banking-apps)
 
 {{#include ../../banners/hacktricks-training.md}}